http://isshort.com
I wrote a blog post about it here: http://sjstrutt.com/is-short
Ask HN: Show me your Half Baked project
291–300 of 313 posts
Re: Ask HN: Show me your Half Baked project
#292Re: Ask HN: Show me your Half Baked project
#293http://www.pixiim.com
Here's a screenshot:
Re: Ask HN: Show me your Half Baked project
#294regvex.py -- http://gist.github.com/641688 Regvex is a proof of concept timing attack against regex engines. To make a long story short, the timing characteristics of regex engines make it perfectly suited to timing attacks, allowing you to (locally or remotely) create data that matches a given regex, and potentially even reconstruct the actual regex you're matching against. The current version works locally against…
You will not be able to reconstruct the regex by a timing attack unless you make some assumptions on the input like maximum length and even then reconstructing the regex will be tough. If you don't make a maximum length assumption then the best you can do is create a string that will pass it because you will never be able to tell the difference between /a+/ and /a{1,10^99999999999999}/. Practically this might not make a difference but theoretically it does.
Re: Ask HN: Show me your Half Baked project
#295regvex.py -- http://gist.github.com/641688 Regvex is a proof of concept timing attack against regex engines. To make a long story short, the timing characteristics of regex engines make it perfectly suited to timing attacks, allowing you to (locally or remotely) create data that matches a given regex, and potentially even reconstruct the actual regex you're matching against. The current version works locally against…
You will not be able to reconstruct the regex by a timing attack unless you make some assumptions on the input like maximum length and even then reconstructing the regex will be tough. If you don't make a maximum length assumption then the best you can do is create a string that will pass it because you will never be able to tell the difference between /a+/ and /a{1,10^99999999999999}/. Practically this might not mak…
Actually, while that was my first thought as well, it depends on the underlying implementation. I'm not positive here, but I think that the characteristics of the regex engine could allow you to recognize the difference between /a+/ and /a{1,1000}/. That said, I haven't done anything to this end yet -- we'll see if my idea remotely pans out. It'll certainly require knowing what regex engine you're attacking, unlike just generating data.
Re: Ask HN: Show me your Half Baked project
#296I just started mine recently, uploaded the first version on heroku yesterday. I got the initial idea from challenge.greplin.com.
http://codingchallenge.heroku.com
Re: Ask HN: Show me your Half Baked project
#297Earlier quoted context omitted.
This is a great project! I'd like a way to be able to list existing tasks / projects and then I would probably use it
when writing "select project" (shortcut : sp) or "select task" (shortcut : st), it lists them so you can choose a task already created.
Great, thanks! I was just typing project names after the command.
Re: Ask HN: Show me your Half Baked project
#298Earlier quoted context omitted.
Yeah, including a bugfix for it to work on Chrome in Linux. I choose a game, submit, then get a blank page with just the header.
Thank you for the feedback. It's worth noting that if you don't have flash, it won't work. It currently relies on flash for persistent socket connections. I'm working on getting it working with websockets. But it should work on chrme, which is also my browser of choice.
Interesting, I do have flash block, but disabled it for your site. I still didn't get anything, but perhaps flashblock is still at fault.
Re: Ask HN: Show me your Half Baked project
#299http://movief.ly Wanted a place to keep track of what movies I was watching, when and who I was watching them with, and then be able to recall them later. For instance: Recent movies watched http://movief.ly/users/adamfortuna/viewings Movies first seen in 2009 http://movief.ly/users/adamfortuna/lists/first-seen-in-2009 Never went beyond the 'scratch my own itch' stage, but gomiso seems to like the idea of checking in…
i like this idea. my husband and i are always watching tons of movies and can never keep track.
Thanks! I really want to get it to the point where it can look into your friends lists to generate lists as well.
For instance -- What're my girlfriends favorite movies that I've never seen? Or What are my friends favorite movies of all time (that I have seen or haven't seen)? In the end it's all about keeping track of what you've seen, and helping decide what you should see next though, so it might have Netflix integration so I don't have to reinvent the recommendation wheel either. What movies you'll like is only half the equation though -- the other half is what people you know are actually watching!
Re: Ask HN: Show me your Half Baked project
#300Earlier quoted context omitted.
You will not be able to reconstruct the regex by a timing attack unless you make some assumptions on the input like maximum length and even then reconstructing the regex will be tough. If you don't make a maximum length assumption then the best you can do is create a string that will pass it because you will never be able to tell the difference between /a+/ and /a{1,10^99999999999999}/. Practically this might not mak…
Actually, while that was my first thought as well, it depends on the underlying implementation. I'm not positive here, but I think that the characteristics of the regex engine could allow you to recognize the difference between /a+/ and /a{1,1000}/. That said, I haven't done anything to this end yet -- we'll see if my idea remotely pans out. It'll certainly require knowing what regex engine you're attacking, unlike j…
You're probably right. I think the idea is really cool and I'm surprised some CS grad student hasn't jumped on this stuff yet. There is a lot of theory lurking in the background for this kind of stuff and it would definitely make a nice master's thesis.